Declare centrally. Reconcile locally. Report by exception.
A distributed intelligence fabric succeeds or fails on a problem that is neither sensing nor inference: operating the fleet. Hundreds to thousands of edge nodes — carried by teams, mounted on vehicles, embedded in autonomous platforms, or bolted to poles — must be enrolled, configured, kept healthy, updated, and recovered when they fail, across intermittent, contested, and bandwidth-poor links. Doing this by hand does not scale past a handful of nodes; doing it with a conventional cloud device-management service violates the sovereignty, classification, and disconnection constraints these fabrics live under.
Helios Grid is Enkidu's answer: a sovereign, self-hosted control plane, and the third foundational framework of the stack. To the established premise — determinism where it matters, reasoning where it helps — Helios adds its own corollary: declaration where it scales. Fleet state is declared, signed, and reconciled by pull, so a node that has been dark for a day converges to the same state as a node that never lost its link.
- Fleet lifecycle at scale — zero-touch enrolment, node twins, pull reconciliation
- Safe artifact distribution — signed, staged, health-gated, reversible
- Fleet-scale observability — within a strict telemetry envelope
- Autonomous event response — bounded remediation, human escalation
One component at every tier
Helios rides the same bearers as the data plane — with its own, strictly smaller traffic class. The hub is the unit of autonomy: a cluster cut off from the centre continues to reconcile, monitor, and remediate locally. And distribution follows the fabric: a 2 GB model update to a 40-node cluster costs the reachback link one transfer, not forty.
Helios's authoritative record of every managed node — identity, hardware tier, installed versions, bound policies, current health, desired state. The twin is what the fleet operator sees; the node is what exists in the field. Operators and the event engine reason over twins, never ad-hoc queries to the field.
Canary → cluster → theatre.
Gates between, rollback behind.
No artifact reaches the whole fleet at once. A rollout declares its waves and the health gates between them — latency and accuracy within bounds on the canary, no elevated error-zone entries, no trust demotions attributable to the new artifact. A gate failure freezes the wave and triggers automatic rollback. Models swap live through the serving layer without dropping availability; system images install to the inactive slot and commit only on a passing health check.
A model that cannot show its provenance cannot enter the registry; a model not in the registry cannot reach a node. Models are policy encodings — versioned and governed like policy changes.
Fleet-scale visibility
without fleet-scale bandwidth.
The edge reduces; the fabric forwards signal; raw data never leaves the node on a control channel. Each node holds a signed telemetry envelope — its per-interval budget, priority classes, and degraded-mode behaviour — and each link upstream carries an order of magnitude less than the one below it. The Warden computes a per-node health score an operator can rank a thousand nodes by; alert rules run at the lowest tier that has the data, so a node raises its own alarm even when it is alone in the dark.
Model health is a first-class metric: confidence distributions, abstention rates, drift indicators — the operational feed for retraining triggers and Origi's drift monitoring.
